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— Presidency compromise texts 


With a view to the Law Enforcement Working Party (Police) meeting on 16 March 2023, 
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ANNEX 


Proposal for a 
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 


laying down rules to prevent and combat child sexual abuse 


(Text with EEA relevance) 
CHAPTERI 
GENERAL PROVISIONS 
Article 1 
Subject matter and scope 
[end 


[No new compromise texts in this Article] 


Article 2 
Definitions 
ee 
[No new compromise texts in this Article] 
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CHAPTERII 
OBLIGATIONS OF PROVIDERS OF RELEVANT INFORMATION SOCIETY SERVICES 
TO PREVENT AND COMBAT ONLINE CHILD SEXUAL ABUSE 


Section 1 
Risk assessment and mitigation obligations 


Article 3 


Risk assessment 


Fea] 
[No new compromise texts in this Article] 
Article 4 
Risk mitigation 
[...] 
[No new compromise texts in this Article] 
Article 5 
Risk reporting 
Lis 
[No new compromise texts in this Article] 
Article 6 


Obligations for software application stores 


fag 


[No new compromise texts in this Article] 
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Section 2 
Detection obligations 


Article 7 
Issuance of detection orders 
[...] 
[No new compromise texts in this Article] 
Article § 
Additional rules regarding detection orders 
Fal 
[No new compromise texts in this Article] 
Article 9 
Redress, information, reporting and modification of detection orders 
Lasf 
[No new compromise texts in this Article] 
Article 10 
Technologies and safeguards 
ikea! 
[No new compromise texts in this Article] 
Article 11 
Guidelines regarding detection obligations 
fee] 


[No new compromise texts in this Article] 


7038/23 FL/ml 
ANNEX JALI LIMITE 


EN 


Section 3 
Reporting obligations 
Article 12 
Reporting obligations 


Where a provider of hosting services or a provider of interpersonal communications 
services becomes aware in any manner other than through a removal order issued in 
accordance with this Regulation of any information that giving_risete—a—suspicion—of 
indicate potential online child sexual abuse on its services, it shall promptly submit a 
report thereon to the EU Centre in accordance with Article 13. It shall do so through the 
system established in accordance with Article 39(2). 


Where the provider submits a report pursuant to paragraph 1, it shall inform the user 
concerned, in accordance with the following sub-paragraphs providing information on 
the main content of the reporter +the-mannerinwhichthe provider has become-aware-of 


such_infermation_is—available tethe_previder and on the user’s possibilities of redress, 
including on the right to submit complaints to the Coordinating Authority in accordance 
with Article 34. 


The provider shall inform the user concerned without undue delay, either after having 
received a communication from the EU Centre indicating that it considers the report to be 
manifestly unfounded as referred to in Article 48(2), or after the expiry of a time period of 
six three months from the date of the report without having received a communication 
from the EU Centre indicating that the information is not to be provided as referred to in 
Article 48(6), point (a), whichever occurs first. The time period of six months refered to 
in this subparagraph shall be extended by up to 6 months where so requested by the 
competent authority referred to in Article 48(6)-poimta. 


Where within the three-menths- time period referred to in the second subparagraph the 
provider receives such a communication from the EU Centre indicating that the 
information is not to be provided, it shall inform the user concerned, without undue delay, 
after the expiry of the time period set out in that communication. 


The provider shall establish and operate an easy to access, accessible, effective, child- 
friendly age-appropriate and user-friendly mechanism that allows users to notify fleg to 
the provider information that indicate potential online child sexual abuse on its—the 
service. Those mechanisms shall allow for the submission of notices by individuals or 
entities exclusively by electronic means and without requiring that the user declare 
name or email address. 
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The mechanisms shall be such as to facilitate the submission of sufficiently precise 
and adequately substantiated notices. To that end, the providers shall take the 
necessary measures, with particular attention to the needs of the child, to enable and 
to facilitate the submission of notices, with a view to receiving: 


(a) a sufficiently substantiated explanation of the reasons why the user alleges the 
information in question to be online child sexual abuse; 


(b) a clear indication of the online location of that information [, such as the exact 
URL or URLs,] and, where necessary, additional information enabling the 
identification of the online location of the alleged online child sexual abuse 
adapted to the specific type of service. 


4. The Commission, in cooperation with Coordinating Authorities and the EU Centre 
and_ after having conducted a public consultation, shall issue guidelines on the 
application of paragraph 3, having due regard in particular to the child's age, 
maturity, views, needs and concerns. 


Article 13 
Specific requirements for reporting! 

1. Providers of hosting services and providers of interpersonal communications services shall 
submit the report referred to in Article 12 using the template set out in Annex III. The 
report shall include: 

(a) identification details of the provider and, where applicable, its legal representative; 
(b) the date, time stamp and electronic signature of the provider; 


(ba) manner in which the provider became aware of the potential child sexual abuse; 


(c) aH-content data related _to the reported potential online child sexual abuse; 
inchidine +maces, videos-and text; 


(d) aH other available data related to the reported potential online child sexual abuse, 
including metadata related to media files and communications;” 


(e) whether the potential online child sexual abuse concerns the dissemination of known 
or new child sexual abuse material or the solicitation of children; 


PCY comment: a recital could be included that would explain that since this CSA 
Regulation is /ex specialis to the DSA, reporting on CSA will only be carried out pursuant to 
this CSA Regulation and not pursuant to the DSA. That means that double reporting on 
CSA will be avoided. 

PCY comment: we conclude from the discussion in LEWP on 24 February that the reference 
to metadata in this Article may need further elaboration. What is the view of delegations 
on this point? 
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(f) information concerning the geographic location related to the potential online child 
sexual abuse, such as the Internet Protocol address of upload, with associated date 
and time stamp, and port number; 


(g) information concerning the identity of any user involved in the potential online child 
sexual abuse; 


(h) whether the provider has also reported, or will also report, the information that 
indicate potential online child sexual abuse to a public authority or other entity 
competent to receive such reports from ef a third country and if so, which authority 
or entity; 


(i) where the information that indicate potential online child sexual abuse concerns the 
dissemination of known or new child sexual abuse material, whether the provider has 
removed or disabled access to the material; 


(j) whether the provider considers that the report involves an imminent threat to 
the life or safety of a child or requires urgent action; * 


(k) areference to this Regulation as the legal basis for reporting. 


In the case of an imminent threat to the life or safety of a child, the providers of 
hosting services _and_ providers of interpersonal communications services shall 

romptly and directly, in addition to paragraph 1(j), inform authorities competent to 
for the investigation and _ prosecution of criminal offences in the Member States 
concerned’. Where the provider _cannot identify with reasonable certainty the 
Member State concerned, it shall inform the law enforcement authorities of the 
Member State in which it is established ot where its legal representative resides or is 
established or inform Europol, or both°. 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annex III to improve the template where necessary in view of relevant 
technological developments or practical experiences gained. 


3 


In the template of Annex III, section 2, point 1, we could add the reason for the urgency. 


- Wording copied from Art. 14(5) of the TCO Regulation. 
> Wording copied from Art. 18(2) of the DSA. 
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Section 4 
Removal obligations 


Article 14 


Removal orders 


fe ee 


Re courts—OF one ee tay ante ney S He rel 36(1) 
ddentitied-eonstittie chic este bie terra 


i The competent authority shall have the power to issue a removal order requiring a 
provider of hosting services to remove or disable access in all Member States of one 
or more specific items of material that, after a diligent assessment, the Coordinating 
Authority orthe courts or other independent administrative authorities referred +ein 
Article 36) is identified as constituting child sexual abuse material. 


2, The provider shall execute the removal order as soon as possible and in any event within 
24 1 hours of receipt thereof.® The provider shall take the necessary measures to ensure 
that it is capable to reinstate the material or access thereto in accordance with Article 
15(1a). 


3: Fhe-competent judicial authority-orthe independent administrative-authority shal issue-a 
A removal order shall be issued using the template set out in Annex IV. Removal orders 
shall include: 


(a) identification details of the eempetent—judicial_or—ndependent—administrative 
authority issuing the removal order and authentication of the removal order by that 
authority; 


(b) the name of the provider and, where applicable, of its legal representative; 


(c) the specific service in respect of fer which the removal order is issued; 


. PCY comment: we interpret the discussions in LEWP on 24 February as non-conclusive. 


Therefore, there will be a need to settle the issue regarding the time period (one hour, 24 
hours or something else). 
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(d) a sufficiently detailed statement of reasons explaining why the removal order is 


issued-and 4n-particular-why the material constitutes-chid sexvalabuse materiak 


(da) where applicable, a statement of reasons explaining why the order is issued to a 
service provider that does not have its main establishment or legal 
representative in the Member State of the issuing authority according to the 
procedure provided for in Article 14a; 


(ec) anexactuniform+resourcetocaterand where necessaryadditional clear information 
fortheidentification_of enabling the provider to identify and locate the child 


sexual abuse material and, where necessary, additional information’; 


(f) where applicable, the information about non-disclosure during a specified time 
period, in accordance with Article 15(4), point (c); 


(fa) reporting requirements_pursuant to point 7; 


(g) areference to this Regulation as the legal basis for the removal order; 


(h) the date, time stamp and electronic signature of the jdietal-or—independent 
administrative-competent authority issuing the removal order; 


(i) easily understandable information about the redress available to the addressee of the 
removal order, including information about redress to a court and about the time 
periods applicable to such redress. 


4. The judicial -autherityortheindependent-administratve authority issuing the removal 
order shall address it to the main establishment of the provider or, where applicable, to its 
legal representative designated in accordance with Article 24. 


It-shal transm# The removal order shall be transmitted to the the provider’s point of 
contact referred to in Article 23(1) by electronic means capable of producing a written 
record under conditions that allow to establish the authentication of the sender, including 
the accuracy of the date and the time of sending and receipt of the order, to the 
Coordinating Authority of establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


It shall draft transmit the removal order in any of the official languages declared by the 
provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
official languages declared by the provider in accordance with article 23(3). 


: Copied from Art. 9(2) (iv) of DSA. 
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If the provider cannot execute the removal order on grounds of force majeure or de facto 
impossibility not attributable to it, including for objectively justifiable technical or 
operational reasons, it shall, without undue delay, inform the authority issuing the order 
efestablishment of those grounds, using the template set out in Annex V. 


The time period set out in paragraph 24 shall start to run as soon as the reasons referred to 
in the first subparagraph have ceased to exist. 


If the provider cannot execute the removal order because it contains manifest errors or does 
not contain sufficient information for its execution, it shall, without undue delay, request 
the necessary clarification te from the authority issuing the order ef establishment, using 
the template set out in Annex V. 


The time period set out in paragraph 24 shall start to run as soon as the provider has 
received the necessary clarification. 


The provider shall, without undue delay and using the template set out in Annex VI, 
inform the issuing authority, 

of the measures taken to execute the removal order, indicating, in particular, whether the 
provider removed the child sexual abuse material or disabled access thereto in all Member 
States and the date and time thereof. 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes IV, V and VI where necessary to improve the templates in view 
of relevant technological developments or practical experiences gained. 


Article 14a 
Procedure for cross-border removal orders 


Subject to Article 14, where the hosting service provider does not have its main 
establishment or legal representative in the Member State of the authority that issued 
the removal order, that authority shall, simultaneously, transmit a copy of the 
removal order to the Coordinating Authority of the Member State where the hosting 
service provider has its main establishment or where its legal representative resides 
or is established. If the receiving Coordinating Authority is not the competent 
authority, it shall transmit the order to the competent authority for the purpose of the 
procedure of this Article. 


Where a hosting service provider receives a removal order as referred to in this 
Article, it shall take the measures provided for in Article 14 and take the necessary 
measures to be able to reinstate the content or access thereto, in accordance with 
paragraph 6 of this Article. 
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la. 


The Coordinating Authority or the competent authority of the Member State where 
the hosting service provider has its main establishment or where its legal 
representative resides or is established may, on its own initiative, within 72 hours of 
receiving the copy of the removal order in accordance with paragraph 1, scrutinise 
the removal order to determine whether it seriously or manifestly infringes this 
Regulation or the fundamental rights and freedoms guaranteed by the Charter. 


Where it finds an infringement, it shall, within the same period, adopt a reasoned 
decision to that effect. 


The Coordinating Authority or the competent authority shall, before adopting a 
decision pursuant to the second subparagraph of paragraph 3, inform the competent 
authority that issued the removal order of its intention to adopt the decision and of its 
reasons for doing so. 


Where the Coordinating Authority or the competent authority adopts a reasoned 
decision in accordance with paragraph 3 of this Article, it shall, without delay, 
transmit that decision to the authority that issued the removal order, the hosting 
service provider and the EU Centre. 


Where the decision finds an infringement pursuant to paragraph 3 of this Article, the 
removal order shall cease to have legal effects. 


Upon receiving a decision finding an infringement communicated in accordance with 
paragraph 5, the hosting service provider concerned shall without undue delay 
reinstate the content or access thereto, without prejudice to the possibility to enforce 
its terms and conditions in accordance with Union and national law. 


Article 15 
Redress and provision of information 


Providers of hosting services that have received a removal order issued in accordance with 
Article 14, as well as the users who provided the material, shall have the right to an 
effective redress. That right shall include the right to challenge such a removal order before 


the courts of the Member State of the coempetent—judicial autherityor independent 
administrative authority that issued the removal order. 


If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate the material or access thereto, without prejudice to the 
possibility to enforce its terms and conditions in accordance with Union and national 
law’. 


: Copied from Art. 4(7) of the TCO Regulation. 
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2 When the removal order becomes final, the eempetent judicial authority—or independent 
administrative authority that issued the removal order shall, without undue delay, transmit 


a copy thereof and copies of the information it has received pursuant to Article 14 (5) 
to (7) to the Coordinating Authority of establishment. The Coordinating Authority of 
establishment shall then, without undue delay, transmit a-cepy copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a removal order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the removal order following an appeal. 


3. Where a provider removes or disables access to child sexual abuse material pursuant to a 
removal order issued in accordance with Article 14, it shall without undue delay, inform 
the user who provided the material of the following: 


(a) the fact that it removed the material or disabled access thereto; 


(b) the reasons for the removal or disabling, providing a copy of the removal order upon 
the user’s request; 


(c) the user’s right to judicial redress referred to in paragraph | and the user’s right to 
submit complaints to the Coordinating Authority in accordance with Article 34. 


4. The issuing authority Coordinating Authority of establishment may decide request, when 
Feqtestine the ident Gatherer ideper dent acts ate a ests th 
removalerder—and after having consulted if necessary with relevant public authorities, 
that the provider is not to disclose any information regarding the removal of or disabling of 
access to the child sexual abuse material, where and to the extent necessary to avoid 
interfering with activities for the prevention, detection, investigation and prosecution of 
child sexual abuse or related criminal offences. 


In such a case: 


(a) the judicial autheritor independent administrative—authority issuing the removal 
order shall inform the provider of its decision specifying the applicable time 
period that shall be setthe+time-peried not longer than necessary and not exceeding 
twelve six-weeks, during which the provider is not to disclose such information; 


(b) the obligations set out in paragraph 3 shall not apply during that time period; 


emer pares ering ae plete Gas oeaed 
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la. 


The issuing Fhatjudicial authority or independent administrative authority may decide to 
extend the time period referred to in the second subparagraph, point (a), by a further time 
period of maximum six weeks, where and to the extent the non-disclosure continues to be 


necessary. In that case, the issuing thatjudicialautherit—or independent administrative 


authority shall inform the provider of its decision, specifying the applicable time period. 


DATE ECOG an te RONEN 


Section 5 
Blocking obligations 


Article 16 


Blocking orders 
pe comperent authority EW e, etl “y me powe. te 


Ie Pema se that Mersber State. to issue a ie ae 


requiring a provider of internet access services under the Jurisdiction of that Member State 
to take pcaonaiie measures to pen users on Sgcessis known ue ue abuse 
material : : 


included in the database _of indicators inact Wh Axticle 44 Caen (b)-and 
provided by the EU Centre.” 


The provider shall execute the blocking order as soon as possible and in any event 
within one week of receipt thereof. The provider shall take the necessary measures to 
ensure that it is capable of reinstating access in accordance with Article 18(1a). 


Eo aber Beane ©, anion Senn Scan NEI! 


whether the conditions 6£ MR AMIE! have been mick 


locators om ah Hs eared tn prapraph I the conditions of Ace 36(1) point 


LEP 1.9 the list ic complete, ser arigeaiid ss to dais: 


9 


PCY comment: see footnote 10 below. 
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(b} po ce RR A Sc ance ee i Lg RCE 


TiO Or Gia a eer ER EU nO 
proasdders inant aacteehreleciea capabilities and ee: 


(c) teu FL Centee to seit a necessary: Mine Ms 


blocking sie: shall be issued: cas sc comttllies that the following conditions are met: 


(a) other equally effective and less intrusive measures than blocking cannot be 
taken to prevent access to child sexual abuse material or it is likely that such 
measure will fail; \ is-e¥ sain atthe sees ee ee been used wuss the ea 


ans ae eins 


(b) the blocking order is necessary to prevent the dissemination of the-child sexual abuse 
material te-users in the Union, having regard in-particulartethe-quantitand nature 


efthe- material to the need to protect the rights of the victims aadthe-existence and 
implementation_-by-the provider ofa poley_to-addressthe tisk of such dissemination; 
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(d) the reasons for issuing the blocking order outweigh negative consequences for the 
rights and legitimate interests of all parties affected, having regard in particular to the 
need to ensure a fair balance between the fundamental rights of those parties, 
including the exercise of the users’ freedom of expression and information and the 
provider’s freedom to conduct a business. 


When assessing whether the conditions of the first subparagraph have been met, account 
shall be taken of all roc evant facts sue circumstances eee ne case at bane: ioe 4 Bey 


ne a the te teey sadicial OF ee ate anatm WRENS ai 
A blocking order; shall: 


(a) where necessary, specify effective and proportionate limits and safeguards 
necessary to ensure that any negative consequences referred to in paragraph 4, point 
(d), remain limited to what is strictly necessary; 


(b) subject to paragraph 6, ensure that the period of application remains limited to what 
is strictly necessary. 


6. The issuing Coordinating—authority shall specify in the blocking order the period during 
which it applies, indicating the start date and the end date. 


The period of application of blocking orders shall not exceed five years. 


a ae ae at eMuest, ‘The ‘Ceca pee or the i issuing 
authority shall, where necessary and at least once every year, assess whether any 


substantial changes to the grounds for issuing the blocking orders have occurred and" 
particular, whether the conditions of paragraph 4 continue to be met. 


find i ee So 


revocation of such order, Where necessary in the light of the outcome of that assessment 
or te—take—account—of justified requests—or other relevant information, including 
information obtained through the reports referred to in Article +8 17(5a) and6), 
respectively an order shall be modified or repealed by the issuing authority, where 


relevant at the request of the Coordinating Authority. Fhe-previsiens-ofthis-Section 
shal apphte-such requests, iutatismutandis. 
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Article 17 


Additional rules regarding blocking orders 


1. Fhe-Coordimatine Authority of establishment shall issuethe A blocking orders-referred+to 
in-Article6 shall be issued using the template set out in Annex VII. Blocking orders shall 


include: 


(b) identification details of the eempetent—udicialautherity—or—the—independent 
administrative authority issuing the blocking order and authentication of the blocking 


order by that authority; 


(c) the name of the provider and, where applicable, its legal representative; 


(d) clear information enabling the provider to identify and locate the child sexual 
abuse material and, where necessary, additional information:the-specifie-service 
Patter aed ieee : 


(e) the start date and the end date of the blocking order; 


(ea) where applicable, the effective and proportionate limits and necessary 


safeguards pursuant to Article 16(5); 


(f) a sufficiently detailed statement of reasons explaining why the blocking order is 
issued; 


(fa) reporting requirements pursuant to paragraph 5a; 


(g) areference to this Regulation as the legal basis for the blocking order; 


(h) the date, time stamp and electronic signature of the judicial autherity—or—the 
independent administrative-authority issuing the blocking order; 


(i) easily understandable information about the redress available to the addressee of the 
blocking order, including information about redress to a court and about the time 
periods applicable to such redress. 


iY PCY comment: the proposal means that a blocking order can only be issued if the subject- 
matter of the blocking is on the list provided for by the EU Centre. This list is compiled 
according to Article 36(1)(b) that stipulates additional requirements, including that the 
blocked online location must be displayed from a third country. Do Member States think 
that there should be such a requirement? Or should it be sufficient that Member States 
share their blocking orders with the EU Centre and other Member States once they 
become final? 
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4a. 


5a. 


The competent judicial _autherity_or—independent_administrative authority issuing the 
blocking order shall address it to the main establishment of the provider or, where 
applicable, to its legal representative designated in accordance with Article 24. 


The blocking order shall be transmitted to the provider’s point of contact referred to in 
Article 23(1) by electronic means capable of producing a written record under 
conditions that allow to establish the authentication of the sender, including the 
accuracy of the date and the time of sending and receipt of the order, to the 
Coordinating Authority of establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


The blocking order shall be drafted-transmitted in any of the official languages declared 
by the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
official languages declared by the provider in accordance with article 23(3). 


If the provider cannot execute the blocking order on grounds of force majeure or de 
facto impossibility not attributable to it, including for objectively justifiable technical 
or operational reasons, it shall, without undue delay, inform the authority issuing the 
order of those grounds, using the template set out in Annex yy. 


If the provider cannot execute the blocking order because it contains manifest errors or 
does not contain sufficient information for its execution, the provider shall, without undue 
delay, request the necessary clarification te from the authority issuing the order 


Coordinatine Authority of establishment using the template set out in Annex VIII. 


The provider shall, without undue delay and using the template set out in Annex xx, 
inform the issuing authority of the measures taken to execute the blocking order, 
indicating, in particular, whether the provider has prevented access to child sexual 
abuse material. 


The authority issuing the order may require the provider to report to it at regular 
intervals on the measures taken and their functioning to execute a blocking order, 
including the effective and proportionate limitations and safeguards provided for. 


Upon request of the issuing authority, the provider shall also provide, without undue 
delay, such reports or any other information relating to the execution of the blocking 
order needed for the purpose of the assessment referred to in Article 16(7). 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes VII, yy, asd-VIII and xx where necessary to improve the 
templates in view of relevant technological developments or practical experiences gained. 
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Article 18 


Redress and provision of information +nformation-and+eportine-of blecking-erders 


1. Providers of internet access services that have received a blocking order;as-welL-as and 
users who provided er-were-prevented from-accessins-a-specticitem-of blocked material 
indicated by the unHform resource tocators_in execution of such_orders, shall have a right to 
effective redress. That right shall include the right to challenge the blocking order before 
the courts of the Member State of the competent—judicial autherity—orindependent 
administrative authority that issued the blocking order. 


la. If the order is repealed as a result of a redress procedure, the provider shall without 


undue delay reinstate access to the material, without prejudice to the possibility to 
enforce its terms and conditions in accordance with Union and national law. 


2 When the blocking order becomes final, the 
admunstrative authority that issued the blocking order shall, without undue delay, transmit 
a copy thereof and copies of information it has received pursuant to Article 17 (4a) to 
(5a) the Coordinating Authority of establishment. The Coordinating Authority of 
establishment shall then, without undue delay, transmit a-cepy¥ copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a blocking order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the removal order following an appeal. 


3: The provider shall establish and operate an accessible, age-appropriate and user-friendly 
mechanism that allows users to submit to it-withit+-a+easonabletimeframe, complaints 
about alleged infringements of its obligations under this Section. It shall process such 
complaints in an objective, effective and timely manner." 


4. Where a provider prevents users from accessing child sexual abuse material the-antform 
resource tecaters pursuant to a blocking order issued+n-accordance-with Article, it shall 
take reasonable measures to inform-thke those users of the following: 


(a) the fact that it does so pursuant to a blocking order; 


uy PCY comment: this complaint mechanism applies only to blocking orders. Do Member 


States think that a horizontal mechanism of providers along the lines of Article 20 DSA 
would be preferable (in combination with the complaint mechanism of Coordinating 
Authorities in Article 34)? 
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(c) the users? right of users who provided the blocked material to judicial redress 
referred to in paragraph 1, thet rights of users to submit complaints to the provider 
through the mechanism referred to in paragraph 3 and to the Coordinating Authority 


in accordance with Article 34-as-vel-asthei+icht+e-submit the requests referred to 


Ages gs Pec bi ical Gall RES dite, ie amen RRA: 


teexecote the blocking order ineticine the atest prodded tor attest eee hat tote 
; hd ad ePaanlaaton: 
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Section 5a 
Delisting obligations 


Article 18a 
Delisting orders 


1. The competent authority shall have the power to issue an order requiring a provider 
of online search engines under the jurisdiction of that Member State to take 
reasonable measures to delist an online location where child sexual abuse material 
can be found from appearing in search results. 


2. The provider shall execute the delisting order without undue delay and in any event 
within one week of receipt of the order. The provider shall take the necessary 
measures to ensure that it is capable of reinstating the delisted online location to 
appear in search results in accordance with Article 18c(2). 


4. A delisting order shall be issued where the following conditions are met: 


(a) the delisting is necessary to prevent the dissemination of the child sexual abuse 
material in the Union, having regard in particular to the need to protect the 
rights of the victims; 


(b) search results correspond, in a sufficiently reliable manner, to online locations 
where child sexual abuse material can be found. 


5. The issuing authority shall specify in the delisting order the period during which it 
applies, indicating the start date and the end date. 


The period of application of delisting orders shall not exceed five years. 


6. The Coordinating Authority or the issuing authority shall, where necessary and at 
least once every year, assess whether any substantial changes to the grounds for 
issuing the delisting orders have occurred and whether the conditions of paragraph 4 
continue to be met. 


Where necessary in the light of the outcome of that assessment or information of the 
reports referred to in Article 18b(6) an order may be modified or repealed by the 
issuing authority, where relevant at the request of the Coordinating Authority. 
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Article 18b 
Additional rules regarding delisting orders 


1. A delisting order shall be issued using the template set out in annex zz. Delisting 
orders shall include: 


(a) identification details of the authority issuing the delisting order and 
authentication of the order by that authority; 


(b) the name of the provider and, where applicable, its legal representative; 


(c) clear information enabling the provider to identify and locate the child sexual 
abuse material and, where necessary, additional information; 


(d) the start and end date of the delisting; 


(e) a sufficiently detailed statement of reasons explaining why the delisting order is 
issued; 


(f) reporting requirements pursuant to point 6; 
(g) areference to this Regulation as the legal basis for delisting; 


(h) the date, time stamp and electronic signature of the authority issuing the 
delisting order; 


(i) easily understandable information about the redress available, including 
information about redress to a court and about the time periods applicable to 
such redress. 


2. The authority issuing the delisting order shall address it to the main establishment of 
the provider or, where applicable, to its legal representative designated in accordance 
with Article 24. 


The delisting order shall be transmitted to the provider’s point of contact referred to 
in Article 23(1) by electronic means capable of producing a written record under 
conditions that allow to establish the authentication of the sender, including the 
accuracy of the date and the time of sending and receipt of the order to the 
Coordinating Authority of establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


3. The delisting order shall be transmitted in any of the offical languages declared by 
the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
offical languages declared by the provider in accordance with Article 23(3). 
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4. If the provider cannot execute the delisting order on grounds of force majeure or de 
facto impossibility not attributable to it, including for objectively justifiable technical 
or operational reasons, it shall, without undue delay, inform the authority issuing the 
order of those grounds, using the template set out in Annex qq. 


5. If the provider cannot execute the delisting order because it contains manifest errors 
or does not contain sufficient information for its execution, the provider shall, without 
undue delay, request the necessary clarification from the authority issuing the order, 
using the template set out in Annex pp. 


6. The provider shall, without undue delay and using the template set out in Annex ww, 
inform the issuing authority of the measures taken to execute the delisting order, 
indicating, in particular, whether the provider has prevented search results for the 
online location with child sexual abuse material to appear. 


The authority issuing the order may require the provider to report to it regularly on 
the measures taken to execute a delisting order. 


Ti The Commission shall be empowered to adopt delegated acts in accordance with 
Article 86 in order to amend Annexes zz, qq and pp where necessary to improve the 
templates in view of relevant technological developments or practical experiences 


gained. 
Article 18c 
Redress and provision of information 
ll, Providers of online search engines that have received a delisting order and users that 


provided the material to a delisted online location shall have a right to effective 
redress. That right shall include the right to challenge the delisting order before the 
courts of the Member State of the authority that issued the delisting order. 


2. If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate the delisted online location to appear in search results, without 
prejudice to the possibility to enforce its terms and conditions in accordance with 
Union and national law. 


3. When the delisting order becomes final, the issuing authority shall, without undue 
delay, transmit a copy thereof and information it has received pursuant to Article 18b 
(4) to (6) to the Coordinating Authority of establishment. The Coordinating Authority 
of establishment shall then, without undue delay, transmit a copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a delisting order shall become final upon 
the expiry of the time period for appeal where no appeal has been lodged in 
accordance with national law or upon confirmation of the delisting order following an 
appeal. 
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Where a provider prevents users from obtaining search results for child sexual abuse 
material corresponding to an online location pursuant to a delisting order, it shall 
take reasonable measures to inform users that provided the material to a delisted 
online location and those users of the following: 


(a) the fact that it does so pursuant to a delisting order; 
(b) the right of users that provided the material to a delisted online location to 


judicial redress referred to in paragraph 1 and users’ right to submit 
complaints to the Coordinating Authority in accordance with Article 34. 


Section 6 
Additional provisions 


Article 19 


Liability of providers 


Providers of relevant information society services shall not be liable for child sexual abuse offences 


if solebhytbeeause they carry out, in good faith, the—-neeessary activities to comply with the 


requirements_of-this Regulation, in particular activities aimed at assessing and mitigating risk, 
detecting, identifying, reporting, removing, disabling ef-access to, blocking or delisting from 


search results reporting online child sexual abuse #-accerdanee-with these requirements. 


Article 20 
Victims’ right to information 


Persons residing in the Union shall have the right to receive, upon their request, from the 
Coordinating Authority destenatedby in the Member State where they reside, information 
regarding any instances where the dissemination of known child sexual abuse material 
depicting them is reported to the EU Centre pursuant to Article 12. Persons with 
disabilities shall have the right to ask and receive such an information in a manner 
accessible to them. 


That Coordinating Authority shall transmit the request to the EU Centre through the 
system established in accordance with Article 39(2) and shall communicate the results 
received from the EU Centre to the person making the request. 


The request referred to in paragraph | shall indicate: 
(a) the relevant item or items of known child sexual abuse material; 


(b) where applicable, the individual or entity that is to receive the information on behalf 
of the person making the request; 


(c) sufficient elements to demonstrate the identity of the person making the request. 
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The information referred to in paragraph | shall include: 
(a) the identification of the provider that submitted the report; 
(b) the date of the report; 


(c) whether the EU Centre forwarded the report in accordance with Article 48(3) and, if 
so, to which authorities; 


(d) whether the provider reported having removed or disabled access to the material, in 
accordance with Article 13(1), point (1). 


Article 21 
Victims’ right of assistance and support for removal 
Providers of hosting services shall provide reasenable-assistance, on request, to persons 


residing in the Union that seek to have one or more specific items of known child sexual 
abuse material depicting them removed or to have access thereto disabled by the provider. 


Persons residing in the Union shall have the right to receive support—upenther-request, 
from the Coordinating Authority desienated—-by in the Member State where they-persen 
resides, to request_assistance,suppert from the EU Centre when they seek to have a 
provider of hosting services remove or disable access to one or more specific items of 
known child sexual abuse material depicting them. Persons with disabilities shall have the 
right to ask and receive any information relating to such support in a manner accessible to 
them. 


That Coordinating Authority shall transmit the request to the EU Centre through the 
system established in accordance with Article 39(2) and shall communicate the results 
received from the EU Centre to the person making the request. 


The requests referred to in paragraphs | and 2 shall indicate the relevant item or items of 
child sexual abuse material. The request does not have to indicate a specific provider. 


The EU Centre’s support referred to in paragraph 2 shall include, as applicable: 


(b) verifying whether the provider removed or disabled access to that item or those 
items, including by conducting the searches referred to in Article 49(1); 


(c) notifying the item or items of known child sexual abuse material depicting the person 
to the provider and requesting removal or disabling of access, in accordance with 
Article 49(2); 


(d) where necessary, informing the Coordinating Authority of establishment of the 
presence of that item or those items on the service, with a view to the issuance of a 
removal order pursuant to Article 14. 
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Article 22 
Preservation of information 


1. Providers of hosting services and providers of interpersonal communications services shall 
preserve the content data and other data processed in-connectiontethe-measurestaken to 
comply with this Regulation and the personal data generated through such processing, 
when the following measures have been taken or for the purposes of complaints or redress 


procedures cemplaints-enly for one-or more-of the folowing purpeses, as applicable: 


(a) executing a detection order issued pursuant to Article 7, or a removal order issued 
pursuant to Article 14 [or_a blocking order pursuant to Article 16 or a delisting 
order pursuant to Article 18a ]; 


(b) reporting information that indicate potential online child sexual abuse to the EU 
Centre pursuant to Article 12; 


(c) blocking the account of, or suspending or terminating the provision of the service to, 
the user concerned; 


(d) handling users’ complaints to the provider or to the Coordinating Authority, or the 
exercise of users’ right to administrative or judicial redress, in respect of alleged 
infringements of this Regulation. 


(e}— 


la. Upon _a_request respendine—to—requests issued by a competent law —enfercement 
authorityies and judicial _autherities—[in accordance with the applicable law], providers 


shall with-a-viewte providers them requesting authority with the necessary information 
for the prevention, detection, investigation or prosecution of child sexual abuse offences; 
or the handling of complaints or admininstrative or judicial redress proceedings, 
insofar as the content data and other data have been preserved for one of the purposes in 
paragraphs 1(a) to (d). relate to-a report that the provider has submitted to the EU Centre 


purstantte Article 2, 
As regards the first subparagraph, point (a), the provider may also preserve the information 
for the purpose of improving the effectiveness and accuracy of the technologies to detect 


online child sexual abuse for the execution of a detection order issued to it in accordance 
with Article 7. However, it shall not store any personal data for that purpose. 


2: Providers shall preserve the information referred to in paragraph 1 for no longer than 
necessary for the applicable purpose and, in any event, no longer than 12 months from the 


date of the measures taken that led to the obligation t to 2 Preser ¢ the content data and 


other data processed 
first. 
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Providers Fhey—shall, upon request from the competent natienalauthority_—er—ceurt, 
preserve the information for a further specified period, set by thatthe requesting authority 
er-court-where and to the extent necessary for ongoing administrative or judicial redress 
proceedings, as referred to in paragraph 1, point (d). 


[i 


Providers shall ensure that the information referred to in paragraph 1 is preserved in a 
secure manner and that the preservation is subject to appropriate technical and 
organisational safeguards. Those safeguards shall ensure, in particular, that the information 
can be accessed and processed only for the purpose for which it is preserved, that a high 
level of security is achieved and that the information is deleted upon the expiry of the 
applicable time periods for preservation. Providers shall regularly review those safeguards 
and adjust them where necessary. 


4. When a detection order pursuant to Article 7, a removal order issued pursuant to 
Article 14 [, a blocking order pursuant to Article 16 or a delisting order pursuant to 
Article 18a] is repealed, the obligation to preserve the content data and other data 
according to paragraph 1 is discontinued. 


Article 23 
Points of contact 


Ie Providers of relevant information society services shall establish a single point of contact 
allowing for direct communication, by electronic means, with the Coordinating 
Authorities, other competent authorities of the Member States, the Commission and the EU 
Centre, for the application of this Regulation. 


2. The providers shall communicate to the EU Centre and make public the information 
necessary to easily identify and communicate with their single points of contact, including 
their names, addresses, the electronic mail addresses and telephone numbers. 


a The providers shall specify in the information referred to in paragraph 2 the official 
language or languages of the Union, which can be used to communicate with their points 
of contact. 


The specified languages shall include at least one of the official languages of the Member 
State in which the provider has its main establishment or, where applicable, where its legal 
representative resides or is established. 
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Article 24 
Legal representative 


Providers of relevant information society services which do not have their main 
establishment in the Union shall designate, in writing, a natural or legal person as its legal 


representative in the Union for the purposes of this Regulation. 


The legal representative shall reside or be established in one of the Member States where 
the provider offers its services. 


The provider shall mandate its legal representatives to be addressed in addition to or 
instead of the provider by the Coordinating Authorities, other competent authorities of the 
Member States and the Commission on all issues necessary for the receipt of, compliance 
with and enforcement of orders and decisions issued in relation to this Regulation, 
including detection orders, removal orders-and, blocking orders and delisting orders. 


The provider shall provide its legal representative with the necessary powers and resources 
to cooperate with the Coordinating Authorities, other competent authorities of the Member 
States and the Commission and to comply with the orders and decisions referred to in 
paragraph 3. 


The desienated-legal representative may be held liable for non-compliance with obligations 
of the provider under this Regulation, without prejudice to the liability and legal actions 
that could be initiated against the provider. 


The provider shall notify the name, address, the electronic mail address and telephone 
number of its legal representative designated pursuant to paragraph | to the Coordinating 
Authority in the Member State where that legal representative resides or is established, and 


to the EU Centre. The provider or the legal representative Fheyshall ensure that that 


information is up to date and publicly available. 


The designation of a legal representative within the Union pursuant to paragraph 1 shall 
not amount to an establishment in the Union. 
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CHAPTER III 


SUPERVISION, ENFORCEMENT AND COOPERATION 


Section 1 
Coordinating Authorities of the Member States-forchild sexual abuse issues 


Article 25 


Coordinating Authorities ferehild-sexvaLlebuseissues and other competent authorities 


1. Member States shall, by (Pate— Ave-twelve months from the date of entry into force of this 
Regulation}, designate one or more competent authorities as responsible for the application 
and enforcement of this Regulation (‘competent authorities’) 


Ze Member States shall, by the date referred to in paragraph 1, designate one of the competent 
authorities as their Coordinating Authority for child sexual abuse issues (‘Coordinating 
Authority’). 


The Coordinating Authority shall be responsible for all matters related to the application 
and enforcement of this Regulation in the Member State concerned, unless that Member 
State has assigned certain specific tasks or sectors to other competent authorities. 


The Coordinating Authority shall in any event be responsible for ensuring coordination at 
national level in respect of those matters and for contributing to the effective efficient and 
consistent application and enforcement of this Regulation throughout the Union. 


3: Where a Member State designates more than one competent authority in addition to the 
Coordinating Authority, it shall ensure that the respective tasks of those authorities and of 
the Coordinating Authority are clearly defined and that they cooperate closely and 
ecu. ee gern ging their tasks. = he Member-State concemed shall communicate 


Centre-and the At sion 


4. Within one week after the designation of the Coordinating Authorities and any—other 


competent authorities pursuant—te—paragraph—t, Member States shall make publicly 
available, and communicate to the Commission and the EU Centre, the names of their 


Coordinating Authority and other compentent authorities as well as their respective 
tasks or sectors. They shall keep that information updated. 


5. Each—-Member States shall Ht established a 
contact point within its the—Coordinating Authority’s office to handle requests for 


clarification, feedback and other communications in relation to all matters related to the 
application and enforcement of this Regulation+athat Member-State. Member States shall 
make the information on the contact point publicly available and communicate it to the EU 
Centre. They shall keep that information updated. 
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6. Within two weeks after the designation of the Coordinating Authorities pursuant to 
paragraph 2, the EU Centre shall set up an online register listing the Coordinating 
Authorities and their contact points. The EU Centre shall regularly publish any 
modification thereto. 


7. Coordinating Authorities may, where necessary for the performance of their tasks under 
this Regulation, request the assistance of the EU Centre in carrying out those tasks, in 
particular, by requesting the EU Centre to: 


(a) provide certain information or technical expertise on matters covered by this 
Regulation; 


(b) assist in assessing, in accordance with Article 5(2), the risk assessment conducted or 
updated or the mitigation measures taken by a provider of hosting or interpersonal 
communication services under the jurisdiction of the Member State that designated 
the requesting Coordinating Authority; 


(c) provide opinion on verify the possible need to request competent national 


authorities to issue a detection order,-a+remevalerder_orablockine-orderin respect 
of a service under the jurisdiction of the Member State that designated that 
Coordinating Authority; 


(d) provide opinion on verify the effectiveness of a detection order er-a+removalerder 
issued upon the request of the requesting Coordinating Authority. 


8. The EU Centre shall provide such assistance free of charge and in accordance with its tasks 
and obligations under this Regulation-andinsefarasits reseurces-and priorities alow. 
9. The requirements Heable toe: ies-set-out in Articles 26 24 28 29 


Article 26 


Requirements for Coordinating Authorities 


1. Member States shall ensure that the Coordinating Authorities that they have designated 


carry out perferm their tasks under this Regulation in an objective—+mpartialk transparent 
andtimely and non-discriminatory manner, while fully respecting the fundamental rights 


of-all parties-affected'*. Member States shall ensure that their Coordinating Authorities 
have adequate technical, financial and human resources to carry out their tasks. 


The Coordinating Authorities shall not seek or take instructions from any other body 
in relation to carrying out their tasks under this Regulation. 


u Copied from Art. 13(2) of TCO Regulation. 
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aim, Member States shall-ensure_in particular, that they: 


(b}—have-a-status-enabline them to-act objectiveb- and 4+mpartialy when -carryine out thet 
lor tiie! Diente ten 


(¢}—are free from any externalinfhience whether direct or indirect: 


fae Hei tala ander 


Regulation. 
3: Paragraph 2-1 shall not prevent supervision of the Coordinating Authorities in accordance 


with national constitutional law—te+the-extentthat-such-supervision_dees-not_ affect ther: 
ad ; j aduiariewinie ee 


4. The Coordinating Authorities and other competent authorities shall ensure that their 
relevant _members—of staff have the required qualifications, experience, integrity and 
technical skills to perform their duties. 


abuse_other 


5. The management and other staff of the Coordinating Authorities shall, in accordance with 
Union or national law, be subject to a duty of professional secrecy both during and after 
their term of office, with regard to any confidential information which has come to their 
knowledge in the course of the performance of their tasks. Member States shall ensure that 
the management and other staff are subject to rules guaranteeing that they can carry out 
their tasks in an objective, impartial and independent manner, in particular as regards their 
appointment, dismissal, remuneration and career prospects. 
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Section 2 
Powers of Coordinating the Authorities of Member States 


Article 273 
Investigatory and enforcement powers 
1. Where needed in order_to fer—carrying out their tasks under this Regulation, 


Coordinating Authorities or other competent authorities shall have the following powers 
of investigation, in respect of conduct by providers of relevant information society 
services falling within the competence underthe jurisdiction of the their Member State 
that desienatedthem: 


(a) the power to require those providers, as well as any other persons acting for purposes 
related to their trade, business, craft or profession that may reasonably be aware of 
information relating to a suspected infringement of this Regulation, to provide such 


information without undue delay-within-a+easonable time-period; 


(b) the power to carry out, or to request _a judicial authority to order, on-site 
inspections of any premises that those providers or the-other-those persons referred 
te-+n-peinta) use for purposes related to their trade, business, craft or profession, or 
to request other public authorities to do so, in order to examine, seize, take or obtain 
copies of information relating to a suspected infringement efthis- Regulation in any 
form, irrespective of the storage medium; 


(c) the power to ask any member of staff or representative of those providers or the ether 
those persons to give explanations in respect of any information relating to a 


suspected infringement ef-this-Regulatien—and to record the answers by any 
technical means; 


(d) the power to request information, including to assess whether the measures taken to 
execute a detection order, removal order,—er blocking order or delisting order 
comply with the requirements of this Regulation. 


bi PCY comment: copied word for word from Art. 51 of the DSA as a baseline for further 


discussions. Differences include that (i) both the Coordinating and competent authorities are 
included; (ii) this text speaks about “user”, not “the recipient of a service” and (iii) in point 
3b below the wording “or the infringement results in the regular and structural facilitation 
of child sexual abuse offences” has been maintained. The restruturing of Articles 27 to 30 to 
ensure alignement with DSA has lead to the fact that some cross-references need to be 
corrected. This will be done once the text is stable. 
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Article 28 


Enforcement powers 


2.1—\Where needed for carrying out their tasks under this Regulation, Coordinating 
Authorities or other competent authorities shall have the following enforcement powers, 
in respect of providers of relevant information society services falling within the 


competence underthe+urisdiction of the their Member State that desienated+them: 


2. 


(a) 


(b) 


(c) 


(d) 


(c) 


the power to accept the commitments offered by those providers in relation to their 
compliance with this Regulation and to make those commitments binding; 


the power to order the cessation of infringements ef this-Regulatien and, where 
appropriate, to impose remedies proportionate to the infringement and necessary to 
bring the infringement effectively to an end or to request a judicial authority in 
their Member States to do so; 


the power to impose fines, or request a judicial authority in their Member State to do 
so, in accordance with Article 35 for failure to comply with infrincements-of this 
Regulation, including nen-cemphance-with any of the investigative orders issued 
pursuant to paragraph 1 of this Article 2+and+e-peimt(b} ofthis-paragraph: 


the power to impose a periodic penalty payment, or to request a judicial authorit 

to do so, in accordance with Article 35 to ensure that an infringement ofthis 
Resulatien is terminated in compliance with an order issued pursuant to point (b) of 
this subparagraph or for failure to comply with any of the orders issued pursuant to 


paragraph 1 of this Article. 2+and+te-peint(b)-efthis-parasraph; 


the power to adopt interim measures or to request the competent national judicial 
authority to do so, to avoid the risk of serious harm. 


Member States } additional enforcement £s-to the C 


3. 


As regards the first subparagraph 4, points (c) and (d), Coordinating Authorities or other 
competent autorities shall also have the enforcement powers set out in those points-alse 
in respect of the other persons referred to in paragraph 1-Article 27, for failure to comply 
with any of the orders issued to them pursuant to that paragraph Article. 4. They shall 
only exercise those enforcement powers after having provided those other persons in good 
time with all relevant information relating to such orders, including the applicable time 
period, the fines or periodic payments that may be imposed for failure to comply and 
redress-the possibilities for redress. 
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Article 29 
{dditional-enfi 


3.4—Where needed for carrying out their tasks under this Regulation, Coordinating 


Authorities or other competent authorities shall have the additional enforcement powers 
referred toin-_paragraph2, in respect of providers of relevant information society services 

falling within the competence underthe jurisdiction of their Member State, where that 
designated them, provided that: 


(a}—all other powers pursuant to this Articles27+and2$+to bring about the cessation of an 
infringement efthis Regulation have been exhausteds 


(b)}—and the infringement has not been remedied or is continuing and is -persists; 


(e)}—_the infringement causes-causing serious harm which cannot be avoided through the 
exercise of other powers available under Union or national law, also have the power 


to take the following measures: 


(a) to require the management body of the providers, without undue delay, to examine 
the situation, within-a-+reasenable- time-period andte- 


4}— adopt and submit an action plan setting out the necessary measures to terminate 
the infringement; 


4G#)— ensure that the provider takes those measures; and 


4#4)—report on the measures taken; 


(b) where the Coordinating Authority or other competent authorities consider that 
a provider of relevant information society services has not sufficiently complied 


with the requirements of point (a), that the infringement has not been remedied 
or is continuing and is causing serious harm, and that that infringement entails 
a_criminal offence involving a threat to the life or safety of persons or the 


infringement results in the regular and structural facilitation of child sexual 
abuse offences, to request that the competent judicial authority or other 


independent administrative authority of its the Member State that-desienated_the 
Coordinating Authority te order the temporary restriction of access of users of the 


service concerned by the infringement or, only where that is not technically feasible, 
to the online interface of the provider on which the infringement takes place. -where 


the Coordinating Authority considers that: 
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3.—The Coordinating Authority or other competent authorities shall, prior to submitting the 
request referred to in this paragraph 2, point (b), invite interested parties to submit written 
observations within a period that shall not be less than two weeks, describing the 
measures that it intends to request and identifying the intended addressee_or 
addressees thereof. The provider, the intended addressee or addressees and any other 
third party demonstrating a legitimate interest shall be entitled to participate in the 
proceedings before the competent judicial authority or other independent 
administrative authority. 


on—is intention —e—submi thal te est —within—a_reasonable—time ried_—set—by—_that 


The invitation to-submit wrtter-observations-shall- 


‘bed eters 
tb} — ident the tendediiddresce oniddressces tered 


reer Cie rernrers inthe eedi £e ine-the request 


4.———Any measure ordered upen—the-+request referred _toin—parasraph2_point-fb}, shall be 


proportionate to the nature, gravity, recurrence and duration of the infringement, without 
unduly restricting access to lawful information by users of the service concerned. 


The temperaryrestriction of access shall be apph~for a period of four weeks, subject to the 
possibility for the competent judicial authority or other independent administrative 
authority of the Member State, in its order, to allow the Coordinating Authority or other 
competent authority to extend that period for further periods of the same lengths, subject 
to a maximum number of extensions set by a that judicial authority or other independent 


administrative authority. 


The Coordinating Authority or other competent authority referred to in the previous 
subparagraph shall only extend the period where-t-eensiders, having regard to the rights 
and legHt#mate-interests of all parties affected by the that restriction and all relevant facets 
and circumstances, including any information that the provider, the addressee or 
addressees and any other third party that demonstrated a legitimate interest may provide to 
it, it considers that both of the following conditions have been met: 


(a) the provider has failed to take the necessary measures to terminate the infringement; 


(b) the temporary restriction does not unduly restrict access to lawful information by 
users of the service, having regard to the number of users affected and whether any 
adequate and readily accessible alternatives exist. 


Where the Coordinating Authority or other competent authority considers that the 

conditions set out in the fourth subparagraph, points (a) and (b) these-twe-conditions 
have been met but it cannot further extend the period pursuant to the fourth secend 
subparagraph, it shall submit a new request to the competent judicial authority or other 
independent administrative authority, as referred to in the first subparagraph, point 
(b). 


7038/23 FL/ml 34 
ANNEX JALI LIMITE EN 


4. 4.—The measures taken by the Coordinating Authorities or other competent authorities in 
the exercise of their iwvestigatery-and-enforeement-powers listed in paragraphs 1, 2 and 
3 referredto—n Articles 27 28 and 29 shall be effective, dissuasive and proportionate, 
having regard, in particular, to the nature, gravity, recurrence and duration of the 
infringement efthisReeulation-or suspected infringement to which those measures relate, 
as well as the economic, technical and operational capacity of the provider of relevant 
information society services concerned; where relevant-appheable. 


5.2.——Member States shall lay down specific rules and procedures for the exercise of the 


powers pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of those 
the investigatory and enforcement powers referred+o+nArticles 27 28-and29-is subject to 


adequate safeguards laid down in the applicable national law in compliance with the 

Charter and with the general principles of Union law te-+respectthe fundamental +ichts 
ofall parties-affeeted. In particular, those measures shall only be taken in accordance with 
the right to respect for private life and the rights of defence, including the rights to be heard 
and of access to the file, and subject to the right to an effective judicial remedy of all 


parties affected parties. 


Article 31 
Searches to verify compliance 


Coordinating Authorities or_other_ competent authorities shall have the power to carry out 
searches on publicly accessible material on hosting services to detect the dissemination of known or 
new child sexual abuse material, using the indicators contained in the databases referred to in 
Article 44(1), points (a) and (b), where necessary to verify whether the providers of hosting services 
under the jurisdiction of the Member State that designated the Coordinating Authorities comply 
with their obligations under this Regulation. 


Article 32 
Notification of known child sexual abuse material 


Coordinating Authorities or other competent authorities shall have the power to notify providers 
of hosting services under the jurisdiction of the Member State that designated them of the presence 
on their service of one or more specific items of known child sexual abuse material and to request 
them to remove or disable access to that item or those items, for the providers’ voluntary 
consideration. 


The request shall clearly set out the identification details of the Coordinating Authority making the 
request and information on its contact point referred to in Article 25(5), the necessary information 
for the identification of the item or items of known child sexual abuse material concerned, as well 
as the reasons for the request. The request shall also clearly state that it is for the provider’s 
voluntary consideration. 
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Section 3 
Other provisions on enforcement 
Article 33 
Jurisdiction 


1. The Member State in which the main establishment of the provider of relevant information 
society services is located shall have jurisdiction for the purposes of this Regulation. 


2: A provider of relevant information society services which does not have an establishment 
in the Union shall be deemed to be under the jurisdiction of the Member State where its 
legal representative resides or is established. 


Where a provider failed to appoint a legal representative in accordance with Article 24, all 
Member States shall have jurisdiction. Where a Member State decides to exercise 
jurisdiction under this subparagraph, it shall inform all other Member States and ensure 
that the principle of ne bis in idem is respected. 


Article 34!4 


Right efttsers-of the-service to lodge a complaint 


1. Users and_ any body, organisation or association mandated to exercise the rights 
conferred by this Regulation on their behalf shall have the right to lodge a complaint 
against providers of relevant information society services alleging an infringement of 

this Regulation affectinethem i 


with the Coordinating Authority designated by the Member State where the user is located 
resides-or is-established. 


pis Coordinating Authorities shall provide child-friendly mechanisms to submit a complaint 
under this Article and adopt a child-sensitive approach when handling complaints 
submitted by children, taking due account of the child's age, maturity, views, needs and 
concerns. 


3: The Coordinating Authority recetine the-complaint shall assess the complaint and, where 
appropriate, transmit it to the Coordinating Authority of establishment, accompanied, 


where considered appropriate, by an opinion. 


Where the complaint falls under the responsibility of another competent authority in its 
Member State, that-desienated the Coordinating Authority receiving the complaint,that 


Coordinatine Authority shall transmit it to that ether-competent authority. 


4. During these proceedings, both parties shall have the right to be heard and receive 


appropriate information about the status of the complaint, in accordance with 
national law. 


- PCY comment: copied word for word from Art. 53 of the DSA. 
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Article 34b'> 


Representation 


1. Without prejudice to Directive (EU) 2020/1828 or to any other type of representation 
under national law, users of relevant information society services shall at least have 
the right to mandate a body, organisation or association to exercise the rights 
conferred by this Regulation on their behalf, provided the body, organisation or 
association meets all of the following conditions: 


(a) it operates on a non-profit basis; 


(b) it has been properly constituted in accordance with the law of a Member 
State; 


(c) its statutory objectives include a legitimate interest in ensuring that this 
Regulation is complied with. 


2. Providers of relevant information society services shall take the necessary technical 
and_ organisational measures to ensure that complaints submitted by _ bodies, 
organisations or associations referred to in paragraph 1 of this Article on behalf of 
recipients of the service through the mechanisms referred to in Article xx are 
processed and decided upon with priority and without undue delay. 


Article 3516 
Penalties 


1. Member States shall lay down the rules on penalties applicable to infringements of the 
obligations pursuant to Chapters II and V of this Regulation by providers of relevant 
information society services within their competence underthei— jurisdiction and shall 
take all the necessary measures to ensure that they are implemented in accordance with 
Article 27. 


Fhe-pPenalties shall be effective, proportionate and dissuasive. Member States shall, by 
[Date of application of this Regulation], notify the Commission of those rules and of those 
measures and shall notify it, without delay, of any subsequent amendments affecting them. 


co) PCY comment: copied word for word from Art. 86 of the DSA. To be discussed in relation 


to Articles 18(3) and 34. 
PCY comment: copied word for word from Art. 52 of the DSA (except paragraph 4 that is 
taken from the TCO Regulation). 


16 
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Member States shall ensure that the maximum amount of fines that may be penalties 
imposed for an a failure to comply with an obligation laid down in Chapters II and V 
infringementof this Regulation shall be net-exeeed 6 % of the annual worldwide income 
etelebal turnover of the providers concerned in the preceding financial business-year-of 
the-provider. 3-Member States shall ensure that the maximum amount of the fine that 
may be imposed Penalties for the supply of incorrect, incomplete or misleading 
information, failure to reply or rectify incorrect, incomplete or misleading information ef 
and failure to submit to an en-s#e inspection shall be notexceed 1% of the annual income 


or worldwide glebal turnover of the preceding—business—year-ofthe provider or the-other 
person concerned in the preceeding financial year-referredtoe+n Article 27. 


Member States shall ensure that the maximum amount of a periodic penalty payment shall 
be net-exceed 5 % of the average daily worldwide glebal turnover or income of the 
provider erthe-ether-person_referred_toin Article 27 in the preceding financial year per 
day, calculated from the date specified in the decision concerned. 


Member States shall ensure that the competent authorities, when deciding whether to 
impose a penalty and when determining the type and level of penalty, account is taken of 
all relevant circumstances, including: 

(a) the nature, gravity and duration of the infringement; 

(b) whether the infringement was intentional or negligent; 

(c) afyprevious infringements by the provider or the other person; 


(d) the financial strength of the provider-orthe-other- person; 


(e) the level of cooperation of the provider with the competent authorities orthe-other 
Person, 


(f) the nature and size of the provider-erthe-otherpersen, in particular whether it is a 
micro, small or medium-sized enterprise; 


(g) the degree of fault of the provider or other person, taking into account the technical 
and organisational measures taken by the provider it-to comply with this Regulation. 
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Section 4 
Cooperation 
Article 36 17 
Identification and submission of online child sexual abuse 


Coordinating Authorities shall submit to the EU Centre, without undue delay and through 
the system established in accordance with Article 39(2): 


(a) specific items of material and transcripts of conversations that Coordinating 
Authorities or that the competent judicial authorities or other independent 
administrative authorities of a Member State have identified, after a diligent 
assessment, as constituting child sexual abuse material or the solicitation of children, 
as applicable, for the EU Centre to generate indicators in accordance with Article 
44(3); 


(b) exact uniform resource locators indicating the electronic location of the 
information specific—items—of—material that Coordinating Authorities or that 
competent judicial authorities or other independent administrative authorities of a 
Member State have identified, after a diligent assessment, as constituting child sexual 
abuse material, hosted by providers of hosting services not offering services in the 
Union, that cannot be removed due to those providers’ refusal to remove or disable 
access thereto and to the lack of cooperation by the competent authorities of the third 
country having jurisdiction, for the EU Centre to compile the list of uniform resource 
locators in accordance with Article 44(3). 


Member States shall take the necessary measures to ensure that the Coordinating 
Authorities that they designated receive, without undue delay, the material identified as 
child sexual abuse material, the transcripts of conversations identified as the solicitation of 
children, and the uniform resource locators, identified by a competent judicial authority or 
other independent administrative authority than the Coordinating Authority, for submission 
to the EU Centre in accordance with the first subparagraph. 


Upon the request of the EU Centre where necessary to ensure that the data contained in the 
databases referred to in Article 44(1) are complete, accurate and up-to-date, Coordinating 
Authorities shall verify or provide clarifications or additional information as to whether the 
conditions of paragraph 1, points (a) and (b) have been and, where relevant, continue to be 
met, in respect of a given submission to the EU Centre in accordance with that paragraph. 


17 PCY comment: the LEWP should leave this Article for now and return to it once more clarity 
is reached on the detection and blocking orders. 
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a: Member States shall ensure that, where their law enforcement authorities receive a report 
of the dissemination of new child sexual abuse material or of the solicitation of children 
forwarded to them by the EU Centre in accordance with Article 48(3), a diligent 
assessment is conducted in accordance with paragraph 1 and, if the material or 
conversation is identified as constituting child sexual abuse material or as the solicitation 
of children, the Coordinating Authority submits the material to the EU Centre, in 
accordance with that paragraph, within one month from the date of reception of the report 
or, where the assessment is particularly complex, two months from that date. 


4. They shall also ensure that, where the diligent assessment indicates that the material does 
not constitute child sexual abuse material or the solicitation of children, the Coordinating 
Authority is informed of that outcome and subsequently informs the EU Centre thereof, 
within the time periods specified in the first subparagraph. 


Article 3748 


Cross-border cooperation among Coordinating Authorities 


1. Where a Coordinating Authority that is not the Coordinating Authority of establishment 
has reasons to suspect that a provider of relevant information society services infringed this 
Regulation in a manner negatively affecting the users of the service in the Member 
State of that Coordinating Authority, it may shal-request the Coordinating Authority of 
establishment to assess the matter and to take the necessary investigatory and enforcement 
measures to ensure compliance with this Regulation. 


2: Fhe A request er-+recommendation pursuant referred to in paragraph | shall be duly 
reasoned and at least indicate: 


(a) the point of contact of the provider as set out in Article 23; 


(b) a description of the relevant facts, the provisions of this Regulation concerned and 
the reasons why the Coordinating Authority that sent the request-erthe-Commissien 
suspects, that the provider infringed this Regulation including the description of the 


negative effects of the alleged infringement; 


(c) any other information that the Coordinating Authority that sent the request—orthe 
Commission, considers relevant, including, where appropriate, information gathered 
on its own initiative and or suggestions for specific investigatory or enforcement 
measures to be taken, including interim measures. 


18 PCY comment: copied word for word from Art. 58 of the DSA. 
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a: The Coordinating Authority of establishment shall take utmost account of the requests 


pursuant to paragraph 1 of this Article —assess-the-suspected infringement taking inte 
utmost_account the request _or recommendation referred to_in paragraph |. Where it 


considers that it has insufficient information to assesthe-suspected infrincement-orte-act 
upon the request errecemmendation and has reasons to consider that the Coordinating 


Authority that sent the request-erthe-Commissien, could provide additional information, it 
may request such information. The time period laid down in paragraph 4 shall be 
suspended until that additional information is provided. 


4. The Coordinating Authority of establishment shall, without undue delay and in any event 
not later than two months following receipt of the request er+recommendation pursuant 
referred—to in—paragraph 1, communicate to the Coordinating Authority that sent the 
request-oe she Commissions 1 pu eutcome-of its assessment of the suspected. infringement; 
or that of any other ¢ law—where_relevant, and, 
where-appHeable, an ae of the investigatory or enforcement measures taken or 
envisaged in relation thereto to ensure compliance with this Regulation. 


Article 38!” 
Joint investigations 


1. Coordinating Authorities may participate in joint investigations, which may be coordinated 
with the support of the EU Centre, of matters covered by this Regulation, concerning 
providers of relevant information society services that offer their services in several 
Member States. 


Such joint investigations are without prejudice to the tasks and powers of the participating 
Coordinating Authorities and the requirements applicable to the performance of those tasks 
and exercise of those powers provided for in this Regulation. 


2. The participating Coordinating Authorities shall make the results of the joint investigations 
available to other Coordinating Authorities, the Commission and the EU Centre, through 
the system established in accordance with Article 39(2), for the fulfilment of their 
respective tasks under this Regulation. 


1° PCY comment: The PCY observes that a number of delegations have requested 


clarifications about what is meant with joint investigations, a concept that is close also to 
law enforcement and judicial cooperation. The PCY notes that the elements of the Article 
can be found in Article 58 of the DSA. Do delegations believe that there is need for this 
Article in this context? Are there elements of Article 57 of the DSA on mutual 
assistance, for instance on exchange of information, that can be more relevant? Do 
delegations wish to include an additional article along the lines of Art. 57 of the DSA 
on mutual assistance? 
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Article 39 
GeneraLeCooperation, coordination and information-sharing system 


1. Coordinating Authorities shall cooperate with each other, other competent authorities of 
the Member Statesthat-designated the Coordinating Authority, the Commission, the EU 
Centre and other relevant Union agencies, including Europol, to facilitate the performance 
of their respective tasks under this Regulation and to ensure its effective, efficient and 
consistent application and enforcement. 


la. The authorities and agencies referred to in paragraph 1 may, including with the 
support from the EU Centre, coordinate their work under this Regulation with a view 
to avoiding interference with criminal investigations in different Member States and 
to avoiding duplication of efforts. 


2: The EU Centre shall establish and maintain one or more reliable and secure information 
sharing systems supporting communications between Coordinating Authorities, the 
Commission, the EU Centre, other relevant Union agencies and providers of relevant 
information society services. 


3. The Coordinating Authorities, the Commission, the EU Centre, other relevant Union 
agencies and providers of relevant information society services shall use the information- 
sharing systems referred to in paragraph 2 for all relevant communications pursuant to this 
Regulation. 


4. The Commission shall adopt implementing acts laying down the practical and operational 
arrangements for the functioning of the information-sharing systems referred to in 
paragraph 2 and their interoperability with other relevant systems. Those implementing 
acts shall be adopted in accordance with the advisory procedure referred to in Article 87. 
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